> For the complete documentation index, see [llms.txt](https://docs.curveyield.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.curveyield.com/safety.md).

# CurveYield Security

CurveYield uses computer programs called **smart contracts**, which run on blockchain technology.

Because mistakes in these programs can have serious consequences, **we put all of our contracts through a thorough security review before relying on them.**

### Security Review Process

**We test the system in as many ways and situations as we reasonably can—including unusual combinations of actions—to find mistakes, weaknesses, and unexpected behavior.**

We check what happens during normal use, unusual situations, failures, and when actions happen in unexpected ways or different orders.

We run these checks through simulations to see how the contracts behave together with the other blockchain systems they depend on.

When we find a problem, we correct it and test the affected parts again.

**Different reviewers inspect it → We test it many different ways through simulations → We correct problems and retest → Until we can no longer find any problems.**

Our goal is to **reduce the possibility of mistakes, vulnerabilities, and unexpected problems as much as possible.**

## A Closer Look at the CurveYield Security Audit Process

### 1. We Look for Ways the System Can Fail

Security problems can come from many places.

There can be a mistake in the code. Money can be counted incorrectly. A permission can give someone too much control. Prices or markets can be manipulated. Another contract can behave unexpectedly. Several actions that are harmless on their own can become dangerous when they happen together.

So we do not examine a system from only one point of view.

Every audit examines normal behavior, unusual behavior, extreme conditions, hostile behavior, changing market conditions, failures, unexpected sequences of actions, and combinations that may never have been intended.

**The goal is to give the system as many chances to show us a weakness during the audit as reasonably possible—before real users encounter that weakness with real money.**

### 2. Different Specialists Look for Different Kinds of Problems

CurveYield Security does not use one general AI to scan a contract and produce a score.

Different AI security specialists are built for different jobs.

Some focus on how the system is designed and controlled. Others focus on the code itself. Others examine money, accounting, incentives, and economic attacks. Others focus on testing and simulation. Adversarial reviewers deliberately search for weaknesses, bad assumptions, and attack paths that other reviewers may not have identified.

Each specialist uses its own role-specific instructions, methods, responsibilities, and review standards developed for that type of security work.

These specialist systems are continually refined as the security framework improves.

Where independent analysis matters, reviewers are deliberately separated so that one reviewer's conclusions do not simply become the starting assumptions for everyone else.

### 3. We Use Forked-Chain Simulations to Test the Whole System

Smart contracts do not operate alone.

They interact with tokens, markets, prices, liquidity, exchanges, vaults, governance systems, and other contracts already running on the blockchain.

So reviewing source code alone is not enough.

**We use forked-chain simulations to follow how the whole system behaves through complete sequences of actions and changing blockchain conditions.**

A vault, for example, can be followed through deposits, rewards, withdrawals, price changes, unusual ordering, outside interactions, failures, and the balances left behind afterward.

This allows the audit to examine complete behavior rather than only checking individual pieces of code in isolation.

Some problems only become visible when several parts of a system interact. Forked-chain simulation makes those interactions part of the security review itself.

### 4. Audit Processes

Every audit passes through a broad set of separate security processes. Each examines a different part of the risk.

* **Threat Modeling** — identifies what can go wrong, who or what could cause it, where the system is exposed, and which assumptions matter most to security.
* **Architecture Review** — examines how the system is built, how its parts interact, where control exists, and whether the overall design creates weaknesses.
* **Manual Implementation Review** — examines contract logic, permissions, interactions, state changes, edge cases, and unexpected behavior.
* **Economic & Accounting Review** — examines balances, shares, rewards, fees, prices, incentives, solvency, rounding, and ways financial behavior could be manipulated or produce unintended results.
* **Adversarial Review** — deliberately searches for attack paths, unexpected combinations, broken assumptions, unusual sequences, and weaknesses other parts of the audit may not have identified.
* **Exact Build & Testing** — builds and tests the exact contracts under review so executable behavior can be checked rather than judged only by reading the code.
* **Stateful Forked-Chain Simulation** — runs complete sequences of actions against forked blockchain state and the external systems the contracts depend on.
* **Findings Validation** — challenges suspected problems, checks the evidence behind them, and determines which issues are valid before they become formal findings.
* **Remediation Review** — reviews and retests security fixes to determine whether the original problem was resolved and whether the change introduced another issue.

**These are separate parts of the same audit. One does not replace the others.**

A contract passing one type of review does not remove the need for the rest.

### 5. Automation, Independent Controls, and Human Expertise Work Together

Automation allows CurveYield Security to perform large amounts of specialized analysis, testing, simulation, comparison, and repeated review.

But the automated reviewers are not simply allowed to decide for themselves that their work is complete.

A separate control system tracks required audit stages, reviewer assignments, evidence, findings, remediation work, and completion requirements. This places independent process controls between an individual reviewer's conclusions and completion of the audit.

Experienced human security expertise also remains part of the audit process, providing oversight, judgment, and additional review where human experience is valuable.

**Specialized automation provides scale and depth. Independent process controls provide consistency and accountability. Human expertise provides judgment and oversight.**

CurveYield Security is designed to **reduce the possibility of mistakes, vulnerabilities, and unexpected problems as much as reasonably possible by examining the same system through many different forms of analysis, testing, simulation, validation, and review.**